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Introduction 


1. The Freedom of Information Act 2000 (FOIA) and the 
Environmental Information Regulations 2004 (EIR) gives right 
of public access to information held by public authorities. 


2. An overview of the main provisions of can be found in The 
Guide to Freedom of Information and The Guide to the 
Environmental Information Regulations. 


3. This is part of a series of guidance, which goes into more detail 
than the Guides, to help public authorities to fully understand 
their obligations and promote good practice. 


4. This guidance explains to public authorities how to deal with 
requests for information about the deceased. 


Overview 


e There are no specific exemptions under FOIA for information 
about deceased people. 


e However, in cases where information about the deceased 
requires protection, certain exemptions will apply. 


e On occasion information about the deceased will contain 
information about other living individuals and so the exemption 
for personal information will be relevant. 


e In certain circumstances, such as a request for medical records 
of the deceased, the exemption for confidential information is 
likely to apply. 


e Certain applicants may have rights to access information under 
Access to Health Records legislation, in which case section 21 


will apply. 


e Inthe case of information about the deceased that is 
environmental in nature, the equivalent provisions of the EIR will 
apply, such as regulation 13 (personal information) and 
regulation 12(5)(f) (interests of the person who provided the 
information to the public authority). 
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Consideration of requests about the deceased 


5. 


There are no special exemptions in FOIA for information about 
the deceased. In some cases, such information will not be 
sensitive and the fact that it contains some details about 
someone who has died will not be relevant. Where this is so, 
the request should be considered in the normal way and the 
information may be suitable for disclosure. 


However, there are situations where such information is 
sensitive in nature and consideration of the request will centre 
on the very fact that the information is about the deceased. For 
example, these could be situations where a requester wishes to 
obtain information directly relating to the circumstances in 
which the person dies, in particular, where the person had been 
in hospital or another care institution. This could include the 
health records of the deceased person. In such circumstances, 
a public authority will want to consider whether there are any 
exemptions that could be used to prevent the disclosure of 
such sensitive information. 


The exemption for personal information (section 40) 


7. 


The exemption for personal information only applies to living 
individuals. This means that the exemption cannot be used for 
information about, and which identifies, deceased individuals. 
However, there will be cases where a request for sensitive 
information about a deceased person also relates to personal 
information about another identifiable living individual. 


A deceased person’s medical and social care records are likely 
to contain information about other individuals, such as NHS and 
social services staff. On occasions, information about relatives 
of the deceased may also be included in such records. 


Example 


In ICO Decision Notice FS50153179 a request was made for 
the social care records of a deceased relative. 


It was determined that some of the requested information also 
identified the deceased person’s primary carer and several 
social services and health authority employees. For example, 
the information included care arrangements, visit reports and 
inter-agency correspondence. As some of this information 
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comprised personal data of the third parties, in particular that 
of the primary carer, under the Data Protection Act, the public 
authority had to consider whether disclosure of any of the 
deceased person’s records would contravene the Data 
Protection Principles (by reference to the third party personal 
data). 


9. Inthe case of requests for the medical records of a deceased 
person, it is possible that this could include genetic information 
which may also identify surviving relatives and thereby meet 
the definition of personal data under the Data Protection Act. 


10. For advice on how to deal with requests that involve 
information about living individuals, see our guidance pages for 
more information on how to apply the section 40 exemption. 


The exemption for confidential information (section 41) 


11. This exemption may apply if the information was originally 
obtained from the deceased person. This will be particularly 
relevant for public authorities holding information such as 
health or banking records. 


12. A public authority, on receiving a request for such records, 
must consider whether the necessary ingredients for a duty of 
confidence are present, and, if so, whether there is a public 
interest defence to disclosure. More detail on the approach to 
take when considering this exemption can be found in our 
guidance on information provided in confidence. 


13. A significant amount of case precedent has been developed 
regarding the applicability of the exemption for confidential 
information to requests for medical records of deceased 
persons. This has established that the information contained in 
medical records will generally be confidential, whether it is held 
by the doctor or clinician treating the patient, or has been 
provided by that person to another person (such as an NHS 
trust, a court or the police in connection with a criminal 
investigation). We consider that the duty of confidence will 
continue to apply after the death of the person concerned. 


14. In Pauline Bluck v Information Commissioner and Epsom & St 
Helier University Hospitals NHS Trust (EA/2006/0090, 17 
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September 2007), concerning a request for information about 
the requester’s deceased daughter (including her health 
record), the Information Tribunal confirmed this position and 
stated that even though the person to whom the information 
relates may have died, action for a breach of confidence could 
be taken by the personal representative of the deceased 
person. The exemption would therefore continue to apply. This 
is the position that has been consistently adopted by both the 
Information Commissioner and the Information Rights Tribunal. 


15. The personal representative is defined as the person who is 
entitled to administer the estate of the deceased person under 
the law relating to wills and probate. This will be by virtue of 
either a grant of probate (if the deceased person left a will) or 
letter of administration (if they died intestate). However, in 
determining whether disclosure would constitute an actionable 
breach of confidence, there is no need to be certain that a 
personal representative exists who would be able to take 
action. The important thing is to establish in principle that a 
personal representative might exist who can take such action. 
A public authority should not lay itself open to legal action 
simply because at the time of the request it is unable to 
determine whether or not a deceased person has a personal 
representative. 


Example 


ICO Decision Notice FS50124800 provides a good illustration 
of how section 41 can be applied in such circumstances. 


This case involved a request to an NHS trust for a report that 
had been compiled into the circumstances surrounding the 
deaths of two patients. Much of the information was drawn 
directly from their medical records. 


In order to satisfy the first element of section 41(1) 
information must have been obtained by the public authority 
from another person. Information in medical records is 
considered to be provided by the patient, whether this is 
information given to medical staff during consultations with 
medical staff or other information recorded by health 
professionals concerning the medical care and treatment of 
the patients. 


It is well established that medical records have the necessary 
quality of confidence and in this case it was confirmed that the 
information was imparted in circumstances importing an 
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16. 


17. 


18. 


obligation of confidence. The next stage was to consider 
whether the duty of confidence survived the death of the 
patients concerned. In line with the Tribunal’s findings in the 
Bluck case, the Commissioner decided that the duty of 
confidence continued to apply as it would be unconscionable 
for the public authority to disclose the information to the 
public. Moreover, there was no binding authority against such 
an argument of principle. 


The Commissioner determined that there was no public 
interest in disclosing the information that outweighed the 
public interest in maintaining the duty of confidence. He 
therefore considered that a breach of confidence as a result of 
disclosure would be actionable. Although it was not realistic to 
consider the awarding of damages to a deceased person, the 
Commissioner decided that it would be possible for the 
personal representatives of the deceased to bring an 
injunction preventing publication. 


Consequently, the Commissioner reached the conclusion that 
the information was exempt under section 41. 


Social care records 


Information contained in social care/social services records can 
also continue to be subject to a duty of confidence after the 
death of the individual concerned, and so be exempt under 
section 41. They too will usually be very personal and sensitive 
in nature. 


As with medical records, all the requirements of section 41 
must be met, including that it must have been “obtained by the 
public authority from any other person.” In general, this 
requirement will be met because social care/social services 
records concern the care of an individual, and the information 
can be considered to be obtained from the individual receiving 
the care, and will include assessments and notes of the 
professionals involved in providing the care as well as 
information provided directly by the individual. 


If the other requirements of section 41 are met, the exemption 
can be applied to the disclosure of social care records of a 
deceased individual. 


Example 
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19. 


20. 


In Brian Redman v Information Commissioner and Norfolk 
County Council (EA/2012/0182, 13 November 2012) the First- 
tier Tribunal considered a case concerning a request for the 
social care records of the appellant’s late mother. The Tribunal 
concluded that section 41(1) was engaged on the following 
basis: 


e The information was obtained by the public authority 
from others such as the NHS and Mrs Redman herself; 


e Actions for breach of confidence can survive an 
individual’s death and be taken by personal 
representatives of the deceased person; 


e The information had the necessary quality of 
confidence and that there was an obligation of 
confidence; 


e There would be detriment to the deceased person if 
there was an unauthorised use of the information; and 


e There was no public interest defence available to the 
public authority had it disclosed the information as 
there was no evidence of wrongdoing during the period 
of the authority’s caring role. 


Public information 


Although the presumption is that most information in medical 
and social care records is confidential, the section 41 
exemption may not apply if the information has already been 
made public. For example, the cause of a person’s death will be 
recorded on a death certificate, which is a public document. 
Similarly, the cause of death and other medical information 
may have been put in the public domain by the surviving family 
or as a result of an inquest or court case. If the requested 
information has been put into the public domain before the 
request for information is made, section 41 cannot apply. 


Information accessible to the applicant by other means 
(section 21) 


In general terms, subject to exceptions set out in the 
legislation, the Access to Health Records Act 1990 (AHRA) and 
the Access to Health Records (Northern Ireland) Order 1993 
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2i. 


22. 


23. 


give a right of access to health records of the deceased to the 
personal representatives of the deceased, or to persons who 
may have a claim arising out of the death of the individual. 


The reference to “personal representative” is very specific; the 
right of access can only be granted to such a person, rather 
than any surviving family members or next of kin. In order to 
gain access to the records under the Access to Health Records 
legislation, it is for the applicant to prove to the public 
authority that they have the right of access as a personal 
representative. 


If the applicant does have access rights under the Access to 
Health Records legislation, the information to which they are 
entitled in this way will be exempt from disclosure to them 
under FOIA by virtue of section 21, because it is reasonably 
accessible to them by other means. Access to the records 
should therefore be dealt with under the AHRA or equivalent. 


It is also necessary to consider whether the information itself is 
subject to the Access to Health Records legislation. If the 
information was prepared by social care professionals, and not 
health professionals as required under the AHRA, an applicant 
would have no right of access under AHRA in which case 
section 21 cannot be applied. This was confirmed by the First- 
tier Tribunal in the case of Julia Martyres v Information 
Commissioner and NHS Cambridgeshire (EA/2011/0209, 11 


January 2012). 


Environmental Information Regulations 2004 


24. 


25. 


The same principles will apply to the EIR, for example in 
relation to personal data where the exception at regulation 13 
would apply. As regulation 13 is the direct equivalent of section 
40 of FOIA, see our guidance on the exemption for personal 
information for further information. 


Where information about the deceased is subject to the EIR, 
public authorities should in most cases consider regulation 
12(5)(f) as the ‘equivalent’ to section 41 of FOIA. Although this 
exception makes no direct reference to confidentiality, in 
practice the tests that have to be met in order to satisfy the 
requirements of this exception will be the same as the 
components required to satisfy the confidentiality ‘test’ in 
section 41 of FOIA. 
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26. Further detail can be found in our guidance on the Interests of 


the person who provided the information to the public authority 
(regulation 12(5)(f)). 


Other considerations 


27. Additional guidance is available on our guidance pages if you 
need further information on the public interest test, other FOIA 
exemptions, or EIR exceptions. 


More information 


28. This guidance has been developed drawing on ICO experience. 
Because of this it may provide more detail on issues that are 
often referred to the Information Commissioner than on those 
we rarely see. The guidance will be reviewed and considered 
from time to time in line with new decisions of the Information 
Commissioner, Tribunals and courts. 


29. It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 


30. If you need any more information about this or any other 
aspect of freedom of information, please contact us: see our 
website www. ico.org.uk. 
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